Edit tour

Windows Analysis Report
TL6bE5Uq4y.exe

Overview

General Information

Sample name:	TL6bE5Uq4y.exe renamed because original name is a hash value
Original sample name:	20878a60ab358f3ce3f3f15245ff85ee.exe
Analysis ID:	1456360
MD5:	20878a60ab358f3ce3f3f15245ff85ee
SHA1:	88aa798e432a96967759571b3363827b261573a0
SHA256:	0a0459d9427b37f9dd4f9c35d0e4ffacec8a524591b58f5047b9543c65ecc203
Tags:	32exetrojan
Infos:

Detection

PureLog Stealer, SystemBC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected PureLog Stealer

Yara detected SystemBC

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for dropped file

Machine Learning detection for sample

Send many emails (e-Mail Spam)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Tries to resolve many domain names, but no domain seems valid

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Connects to many different domains

Connects to several IPs in different countries

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Executes massive DNS lookups (> 100)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

TL6bE5Uq4y.exe (PID: 2888 cmdline: "C:\Users\user\Desktop\TL6bE5Uq4y.exe" MD5: 20878A60AB358F3CE3F3F15245FF85EE)

TL6bE5Uq4y.exe (PID: 6544 cmdline: "C:\Users\user\Desktop\TL6bE5Uq4y.exe" MD5: 20878A60AB358F3CE3F3F15245FF85EE)

atebcv.exe (PID: 764 cmdline: C:\ProgramData\lcsxp\atebcv.exe MD5: 20878A60AB358F3CE3F3F15245FF85EE)

atebcv.exe (PID: 2076 cmdline: "C:\ProgramData\lcsxp\atebcv.exe" MD5: 20878A60AB358F3CE3F3F15245FF85EE)

Erddbfj.exe (PID: 3948 cmdline: "C:\Users\user\AppData\Roaming\Erddbfj.exe" MD5: 20878A60AB358F3CE3F3F15245FF85EE)

Erddbfj.exe (PID: 6508 cmdline: "C:\Users\user\AppData\Roaming\Erddbfj.exe" MD5: 20878A60AB358F3CE3F3F15245FF85EE)

Erddbfj.exe (PID: 4676 cmdline: "C:\Users\user\AppData\Roaming\Erddbfj.exe" MD5: 20878A60AB358F3CE3F3F15245FF85EE)

Erddbfj.exe (PID: 2696 cmdline: "C:\Users\user\AppData\Roaming\Erddbfj.exe" MD5: 20878A60AB358F3CE3F3F15245FF85EE)

atebcv.exe (PID: 8920 cmdline: C:\ProgramData\lcsxp\atebcv.exe MD5: 20878A60AB358F3CE3F3F15245FF85EE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SystemBC	SystemBC is a proxy malware leveraging SOCKS5. Based on screenshots used in ads on a underground marketplace, Proofpoint decided to call it SystemBC.SystemBC has been observed occasionally, but more pronounced since June 2019. First samples goes back to October 2018.	No Attribution	https://asec.ahnlab.com/en/33600/ https://blog.reversinglabs.com/blog/code-reuse-across-packers-and-dll-loaders https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.vmware.com/security/2023/06/8base-ransomware-a-heavy-hitting-player.html https://community.riskiq.com/article/47766fbd	https://malpedia.caad.fkie.fraunhofer.de/details/win.systembc

Malware Configuration

Threatname: SystemBC

{"HOST1": "claywyaeropumps.com", "HOST2": "185.43.220.45"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.2888369063.000000000639C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000008.00000002.2872171051.000000000365D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000008.00000002.2888369063.00000000062AC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2681266896.00000000059FC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2681266896.00000000059AC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.2791880326.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
0000000C.00000002.3321385498.0000000004474000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.2791880326.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000000.00000002.2369432268.0000000005CCC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2353742946.0000000002DDF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000004.00000002.2673193611.0000000002C69000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000005.00000002.2791880326.00000000028CE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000008.00000002.2885936304.0000000005366000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.2801205253.0000000003BD2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.2801205253.0000000003D64000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000008.00000002.2872171051.0000000003669000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000004.00000002.2681266896.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2673193611.0000000002C74000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000000.00000002.2385035151.00000000069B0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000008.00000002.2888369063.00000000062FC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2353742946.0000000002DEB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
0000000B.00000002.3296396978.00000000005A5000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000000.00000002.2369432268.00000000058A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2369432268.00000000058A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000005.00000002.2808346384.0000000004ECC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2679390796.0000000004956000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000008.00000002.2872171051.0000000003783000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000C.00000002.3302858252.000000000338A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2379847646.00000000064D0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2355779082.0000000004989000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000C.00000002.3302858252.00000000030CE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2353742946.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2673193611.0000000002D75000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2353742946.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.2791880326.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000008.00000002.2872171051.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2673193611.00000000029A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2369432268.00000000052A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2355779082.0000000004511000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: TL6bE5Uq4y.exe PID: 2888	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: TL6bE5Uq4y.exe PID: 2888	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: TL6bE5Uq4y.exe PID: 2888	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
Process Memory Space: atebcv.exe PID: 764	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: atebcv.exe PID: 764	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: atebcv.exe PID: 764	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
Process Memory Space: Erddbfj.exe PID: 3948	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Erddbfj.exe PID: 3948	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Erddbfj.exe PID: 3948	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
Process Memory Space: Erddbfj.exe PID: 4676	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Erddbfj.exe PID: 4676	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Erddbfj.exe PID: 4676	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
Process Memory Space: Erddbfj.exe PID: 2696	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
Process Memory Space: atebcv.exe PID: 8920	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: atebcv.exe PID: 8920	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 49 entries

Unpacked PEs

Source	Rule	Description	Author
4.2.atebcv.exe.59fc538.15.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.TL6bE5Uq4y.exe.4ac6710.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
8.2.Erddbfj.exe.366124c.3.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
12.2.atebcv.exe.4474ba0.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.atebcv.exe.5a9c558.10.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
5.2.Erddbfj.exe.3c74ba0.13.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.TL6bE5Uq4y.exe.2ded204.4.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
4.2.atebcv.exe.59ac518.11.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.TL6bE5Uq4y.exe.69b0000.20.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.TL6bE5Uq4y.exe.5bdc518.17.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
12.2.atebcv.exe.341c4f0.0.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
5.2.Erddbfj.exe.508cd88.14.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
8.2.Erddbfj.exe.62ac518.17.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.TL6bE5Uq4y.exe.47fd1f0.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.TL6bE5Uq4y.exe.2f9dd28.2.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.TL6bE5Uq4y.exe.47bd1d0.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.atebcv.exe.2e2dc24.0.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
8.2.Erddbfj.exe.62ac518.17.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.atebcv.exe.4956710.6.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.atebcv.exe.2c76f68.2.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
0.2.TL6bE5Uq4y.exe.2f9dd28.2.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
5.2.Erddbfj.exe.3d64be0.9.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.atebcv.exe.2c6cd90.3.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
0.2.TL6bE5Uq4y.exe.5c2c538.15.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
5.2.Erddbfj.exe.2c208f0.4.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
8.2.Erddbfj.exe.3839b08.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
12.2.atebcv.exe.341c4f0.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
8.2.Erddbfj.exe.639c558.16.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
8.2.Erddbfj.exe.366b424.0.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
5.2.Erddbfj.exe.2a508f0.3.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
5.2.Erddbfj.exe.3cc4bc0.11.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.TL6bE5Uq4y.exe.479d1b0.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
8.2.Erddbfj.exe.62fc538.15.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.TL6bE5Uq4y.exe.2de302c.3.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
4.2.atebcv.exe.59ac518.11.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.TL6bE5Uq4y.exe.479d1b0.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
8.2.Erddbfj.exe.5366710.8.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
5.2.Erddbfj.exe.3c74ba0.13.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.TL6bE5Uq4y.exe.5bdc518.17.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.TL6bE5Uq4y.exe.54a1038.11.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
5.2.Erddbfj.exe.2a5aac8.2.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
4.2.atebcv.exe.2e2dc24.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
8.2.Erddbfj.exe.3839b08.4.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
5.2.Erddbfj.exe.2c208f0.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.TL6bE5Uq4y.exe.5ccc558.9.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.TL6bE5Uq4y.exe.64d0000.19.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.TL6bE5Uq4y.exe.47fd1f0.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.TL6bE5Uq4y.exe.54a1038.11.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.TL6bE5Uq4y.exe.47bd1d0.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.TL6bE5Uq4y.exe.64d0000.19.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 45 entries

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\Erddbfj.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\TL6bE5Uq4y.exe, ProcessId: 2888, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Erddbfj

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 200.40.31.8, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\ProgramData\lcsxp\atebcv.exe, Initiated: true, ProcessId: 2076, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49681

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000008.00000002.2872171051.000000000365D000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: SystemBC {"HOST1": "claywyaeropumps.com", "HOST2": "185.43.220.45"}

Multi AV Scanner detection for domain / URL

Source: webmk.de

Virustotal: Detection: 7%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\lcsxp\atebcv.exe	ReversingLabs: Detection: 71%
Source: C:\ProgramData\vjejxvf\ohjwtp.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	ReversingLabs: Detection: 71%

Multi AV Scanner detection for submitted file

Source: TL6bE5Uq4y.exe	ReversingLabs: Detection: 71%
Source: TL6bE5Uq4y.exe	Virustotal: Detection: 67%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\lcsxp\atebcv.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\vjejxvf\ohjwtp.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: TL6bE5Uq4y.exe

Joe Sandbox ML: detected

Source: TL6bE5Uq4y.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: TL6bE5Uq4y.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005E56000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2386794533.0000000006C20000.00000004.08000000.00040000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005D98000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2353742946.0000000002CD5000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 00000004.00000002.2673193611.0000000002BED000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003EEF000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2791880326.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000008.00000002.2872171051.00000000035E2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005E56000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2386794533.0000000006C20000.00000004.08000000.00040000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005D98000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2353742946.0000000002CD5000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 00000004.00000002.2673193611.0000000002BED000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003EEF000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2791880326.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000008.00000002.2872171051.00000000035E2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005CCC000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2385412046.0000000006A10000.00000004.08000000.00040000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2353742946.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005D98000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 00000004.00000002.2673193611.0000000002D75000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003D64000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2791880326.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000008.00000002.2872171051.0000000003783000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 0000000C.00000002.3302858252.000000000338A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005CCC000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2385412046.0000000006A10000.00000004.08000000.00040000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2353742946.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005D98000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 00000004.00000002.2673193611.0000000002D75000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003D64000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2791880326.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000008.00000002.2872171051.0000000003783000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 0000000C.00000002.3302858252.000000000338A000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h		8_2_06B90DD0
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h		8_2_06B90DC4

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: claywyaeropumps.com
Source: Malware configuration extractor	URLs: 185.43.220.45

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: out.ox-bridge.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.frip.nl replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.hhs.vic.gov.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.promocentre.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: distmya.com.ar replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.mazda.com.mx replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.excite.co.jp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.andy-graham.demon.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.etechgear.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.sss.sss replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.axtturbo.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.cogniva.ca replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.running-bear.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.mailxtr.eu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.pontiac.mi.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.oneplusone-group.jp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.fysioteamet.dk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.uv.skjerhs.dk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.twpn.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: face2c.jp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.ecenej.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.frenzel-dettweiler.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.nc-netcore.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.bonmassarambiente.it replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.csomortamas.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.janenewman.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.gcfe.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.rocha.lel.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.bulowlind.se replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.upsolutionpos.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.finmax99.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.bindifencing.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.hunterlegacy.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.rapidresultsmarketing.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.2024.ucac-icam.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.krea-druck.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.sterlingyoung.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.owsleys.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.hrs-papenteich.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.metallbau-neubacher.at replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.st-andrews.lincs.sch.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.takeachallenge.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.nefkom.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.skillstudio.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.mail.state.il.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.stonecastlefunds.ca replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.chelseaschools.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.sekels.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.gmpm.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dabrapids.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.tre-engine.it replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.m.materdei.ac.th replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.optusnet.ocm.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.fairson.net.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cvtelectrical.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.babs.admin.ch replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.atworkohs.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cpol.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.engetop.org.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.enativ.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.madhouse.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.eventscapemanila.com.ca replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.kebone.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.confesercenti-al.it replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.mv-hallstadt.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.bitrot.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.mboxtv.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: out.web.jp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.malcolmd.me.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.rplaceon590.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.keisry.win replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.own-salvation.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.glendaleacademy.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.yabadaba.com.ar replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.ivisby.se replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: out.mamocar.it replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.metrocourt.state.nm.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.kfg.co.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.sobeho.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.fi-hoppe.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.japart.pl replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.giftit.co.il replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: audaxx.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.thesplashpage.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aspmx2.l.google.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.heidenreich1.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.lol.ga replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.geopec.it replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.suwon-c.ac.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.uas-hdq.ae replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.fakt.it replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.delluria.fr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.nielsenhn.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.viahospital.com.tr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.cands.me.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.data61.csiro.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.bethunderwood.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.eliseocafe.it replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 18.31.95.13.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.sondockmedia.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.surveymarketing.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: marcolauretta.it replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.itnatech.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.wmcsd.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.travelliner.nl replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.boxgroup.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.thesplashpage.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.hovepark.org.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.telematics.it replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.authome.it replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.siii.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.premiumin.co replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.begleitfahrzeug.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.skolaharmonia.sk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: brtph8a0.bnr.ca replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mediagraphics.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: w.cn replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.myshyft.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.alpec.co.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.caledonian.ac.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.nefkom.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.bmihealthcare.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.amgo1.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.bbmcontrol.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.swan.ocn.ne.jp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.biblio.eclipse.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.westendpoker.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.geeko.be replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.wever.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.tiscali.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.abesbagels.co.nz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.tele2.se replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.harabou.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.cambridgecentrehonda.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.propsure.com.pk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.guardando.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.email.pl replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: secure.afaqsolutions.ae replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.eslers.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.arafurapearls.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.bathspa.ac.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.ashland.k12.ky.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.studiorepaci.it replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.snu.ac.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.steticlaser.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.stealthintelligence.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.babs.admin.ch replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.ilvoharmonie.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.peakinvest.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.bankofscotlandint.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.playtimesextoys.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: myjujudancefever.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.tochisyoku.or.jp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wolf.maschinenbau.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.heikowerner.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.scml.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.grassit.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kotokpu-m.ac.jp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.alvarezpuga.com.mx replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.owleyes.ch replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.actualocal.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.coldwellbankeraction.com replaycode: Name error (3)

Source: unknown

Network traffic detected: DNS query count 401

Source: unknown

Network traffic detected: IP country count 26

Source: global traffic	TCP traffic: 192.168.2.5:49679 -> 185.43.220.45:4000
Source: global traffic	TCP traffic: 192.168.2.5:49681 -> 200.40.31.8:587
Source: global traffic	TCP traffic: 192.168.2.5:49683 -> 3.33.133.19:587
Source: global traffic	TCP traffic: 192.168.2.5:49684 -> 213.209.1.145:587
Source: global traffic	TCP traffic: 192.168.2.5:49685 -> 142.250.153.26:587
Source: global traffic	TCP traffic: 192.168.2.5:49688 -> 212.101.122.34:587
Source: global traffic	TCP traffic: 192.168.2.5:49689 -> 142.93.237.125:587
Source: global traffic	TCP traffic: 192.168.2.5:49690 -> 46.255.231.19:587
Source: global traffic	TCP traffic: 192.168.2.5:49691 -> 175.135.253.3:587
Source: global traffic	TCP traffic: 192.168.2.5:49692 -> 91.235.53.41:587
Source: global traffic	TCP traffic: 192.168.2.5:49694 -> 3.125.131.179:587
Source: global traffic	TCP traffic: 192.168.2.5:49695 -> 52.101.89.1:587
Source: global traffic	TCP traffic: 192.168.2.5:49696 -> 194.158.122.55:587
Source: global traffic	TCP traffic: 192.168.2.5:49697 -> 120.50.131.112:587
Source: global traffic	TCP traffic: 192.168.2.5:65454 -> 200.40.31.18:587
Source: global traffic	TCP traffic: 192.168.2.5:65455 -> 199.85.66.2:587
Source: global traffic	TCP traffic: 192.168.2.5:65464 -> 220.73.163.120:587
Source: global traffic	TCP traffic: 192.168.2.5:65466 -> 114.179.184.189:587
Source: global traffic	TCP traffic: 192.168.2.5:65473 -> 211.29.132.105:587
Source: global traffic	TCP traffic: 192.168.2.5:65474 -> 203.134.11.2:587
Source: global traffic	TCP traffic: 192.168.2.5:65478 -> 194.153.145.104:587
Source: global traffic	TCP traffic: 192.168.2.5:65482 -> 104.19.239.228:587
Source: global traffic	TCP traffic: 192.168.2.5:65487 -> 209.202.254.90:587
Source: global traffic	TCP traffic: 192.168.2.5:65489 -> 51.195.17.238:587
Source: global traffic	TCP traffic: 192.168.2.5:65490 -> 78.141.12.232:587
Source: global traffic	TCP traffic: 192.168.2.5:65501 -> 197.188.247.60:587
Source: global traffic	TCP traffic: 192.168.2.5:65502 -> 62.149.128.203:587
Source: global traffic	TCP traffic: 192.168.2.5:65507 -> 2.207.150.234:587
Source: global traffic	TCP traffic: 192.168.2.5:65508 -> 59.157.128.15:587
Source: global traffic	TCP traffic: 192.168.2.5:65509 -> 52.223.34.187:587
Source: global traffic	TCP traffic: 192.168.2.5:65513 -> 94.177.209.28:587
Source: global traffic	TCP traffic: 192.168.2.5:65514 -> 163.152.6.23:587
Source: global traffic	TCP traffic: 192.168.2.5:65516 -> 104.26.0.19:587
Source: global traffic	TCP traffic: 192.168.2.5:65521 -> 217.160.233.72:587
Source: global traffic	TCP traffic: 192.168.2.5:65524 -> 213.209.1.147:587
Source: global traffic	TCP traffic: 192.168.2.5:65531 -> 64.91.253.60:587
Source: global traffic	TCP traffic: 192.168.2.5:65532 -> 106.11.253.83:587
Source: global traffic	TCP traffic: 192.168.2.5:65533 -> 52.65.62.102:587
Source: global traffic	TCP traffic: 192.168.2.5:49159 -> 194.19.134.66:587
Source: global traffic	TCP traffic: 192.168.2.5:49161 -> 20.74.41.190:587
Source: global traffic	TCP traffic: 192.168.2.5:49163 -> 217.160.0.220:587
Source: global traffic	TCP traffic: 192.168.2.5:49165 -> 62.24.139.43:587
Source: global traffic	TCP traffic: 192.168.2.5:49173 -> 62.149.188.200:587
Source: global traffic	TCP traffic: 192.168.2.5:49174 -> 167.99.58.179:587
Source: global traffic	TCP traffic: 192.168.2.5:49175 -> 198.185.159.145:587
Source: global traffic	TCP traffic: 192.168.2.5:49180 -> 198.185.159.144:587
Source: global traffic	TCP traffic: 192.168.2.5:49185 -> 139.134.5.153:587
Source: global traffic	TCP traffic: 192.168.2.5:49187 -> 13.248.169.48:587
Source: global traffic	TCP traffic: 192.168.2.5:49191 -> 193.74.71.25:587
Source: global traffic	TCP traffic: 192.168.2.5:49193 -> 69.7.80.87:587
Source: global traffic	TCP traffic: 192.168.2.5:49195 -> 64.136.44.44:587
Source: global traffic	TCP traffic: 192.168.2.5:49199 -> 178.162.221.165:587
Source: global traffic	TCP traffic: 192.168.2.5:49208 -> 199.59.243.226:587
Source: global traffic	TCP traffic: 192.168.2.5:49209 -> 211.62.105.162:587
Source: global traffic	TCP traffic: 192.168.2.5:49210 -> 13.55.195.118:587
Source: global traffic	TCP traffic: 192.168.2.5:49211 -> 193.70.18.144:587
Source: global traffic	TCP traffic: 192.168.2.5:49212 -> 185.164.14.71:587
Source: global traffic	TCP traffic: 192.168.2.5:49213 -> 188.114.96.3:587
Source: global traffic	TCP traffic: 192.168.2.5:49216 -> 210.91.75.243:587
Source: global traffic	TCP traffic: 192.168.2.5:49221 -> 185.187.81.214:587
Source: global traffic	TCP traffic: 192.168.2.5:49238 -> 20.23.140.143:587
Source: global traffic	TCP traffic: 192.168.2.5:49240 -> 142.250.153.27:587
Source: global traffic	TCP traffic: 192.168.2.5:49243 -> 216.239.38.21:587
Source: global traffic	TCP traffic: 192.168.2.5:49252 -> 168.0.132.203:587
Source: global traffic	TCP traffic: 192.168.2.5:49260 -> 87.238.28.12:587
Source: global traffic	TCP traffic: 192.168.2.5:49264 -> 23.106.53.56:587
Source: global traffic	TCP traffic: 192.168.2.5:49275 -> 79.143.126.201:587
Source: global traffic	TCP traffic: 192.168.2.5:49277 -> 185.53.177.20:587
Source: global traffic	TCP traffic: 192.168.2.5:49283 -> 142.251.9.26:587
Source: global traffic	TCP traffic: 192.168.2.5:49284 -> 104.17.71.73:587
Source: global traffic	TCP traffic: 192.168.2.5:49286 -> 193.201.172.98:587
Source: global traffic	TCP traffic: 192.168.2.5:49298 -> 217.160.0.170:587
Source: global traffic	TCP traffic: 192.168.2.5:49305 -> 89.31.143.90:587
Source: global traffic	TCP traffic: 192.168.2.5:49308 -> 202.138.49.32:587
Source: global traffic	TCP traffic: 192.168.2.5:49315 -> 81.19.232.212:587
Source: global traffic	TCP traffic: 192.168.2.5:51675 -> 209.67.129.100:587
Source: global traffic	TCP traffic: 192.168.2.5:51685 -> 80.158.67.40:587
Source: global traffic	TCP traffic: 192.168.2.5:51686 -> 195.200.52.171:587
Source: global traffic	TCP traffic: 192.168.2.5:51692 -> 157.7.107.55:587
Source: global traffic	TCP traffic: 192.168.2.5:51698 -> 62.149.128.166:587
Source: global traffic	TCP traffic: 192.168.2.5:51699 -> 203.134.153.82:587
Source: global traffic	TCP traffic: 192.168.2.5:51702 -> 137.205.28.41:587
Source: global traffic	TCP traffic: 192.168.2.5:51704 -> 212.135.1.103:587
Source: global traffic	TCP traffic: 192.168.2.5:51706 -> 77.78.119.119:587
Source: global traffic	TCP traffic: 192.168.2.5:51712 -> 88.208.252.214:587
Source: global traffic	TCP traffic: 192.168.2.5:51717 -> 195.216.236.10:587
Source: global traffic	TCP traffic: 192.168.2.5:59100 -> 34.249.227.146:587
Source: global traffic	TCP traffic: 192.168.2.5:59102 -> 130.211.160.56:587
Source: global traffic	TCP traffic: 192.168.2.5:59106 -> 45.60.76.192:587
Source: global traffic	TCP traffic: 192.168.2.5:59111 -> 41.193.157.227:587
Source: global traffic	TCP traffic: 192.168.2.5:59129 -> 193.81.82.81:587
Source: global traffic	TCP traffic: 192.168.2.5:59131 -> 203.134.11.8:587
Source: global traffic	TCP traffic: 192.168.2.5:59133 -> 65.20.63.172:587
Source: global traffic	TCP traffic: 192.168.2.5:59146 -> 170.10.128.141:587
Source: global traffic	TCP traffic: 192.168.2.5:59149 -> 45.55.129.29:587
Source: global traffic	TCP traffic: 192.168.2.5:59156 -> 18.66.112.102:587
Source: global traffic	TCP traffic: 192.168.2.5:59173 -> 217.72.192.67:587
Source: global traffic	TCP traffic: 192.168.2.5:59190 -> 27.101.217.76:587
Source: global traffic	TCP traffic: 192.168.2.5:59199 -> 64.136.52.50:587
Source: global traffic	TCP traffic: 192.168.2.5:59204 -> 185.138.42.135:587
Source: global traffic	TCP traffic: 192.168.2.5:59205 -> 200.234.204.130:587
Source: global traffic	TCP traffic: 192.168.2.5:59208 -> 66.70.176.178:587
Source: global traffic	TCP traffic: 192.168.2.5:59235 -> 194.26.53.15:587
Source: global traffic	TCP traffic: 192.168.2.5:59236 -> 83.166.143.44:587
Source: global traffic	TCP traffic: 192.168.2.5:59245 -> 62.149.128.202:587
Source: global traffic	TCP traffic: 192.168.2.5:59248 -> 86.107.36.46:587
Source: global traffic	TCP traffic: 192.168.2.5:59258 -> 59.157.135.3:587
Source: global traffic	TCP traffic: 192.168.2.5:59262 -> 52.101.73.22:587
Source: global traffic	TCP traffic: 192.168.2.5:59288 -> 84.2.43.67:587
Source: global traffic	TCP traffic: 192.168.2.5:59294 -> 5.144.164.174:587
Source: global traffic	TCP traffic: 192.168.2.5:59296 -> 104.22.65.144:587
Source: global traffic	TCP traffic: 192.168.2.5:59297 -> 77.75.78.173:587
Source: global traffic	TCP traffic: 192.168.2.5:59299 -> 54.194.4.151:587
Source: global traffic	TCP traffic: 192.168.2.5:56703 -> 103.20.200.121:587
Source: global traffic	TCP traffic: 192.168.2.5:56710 -> 137.226.78.60:587
Source: global traffic	TCP traffic: 192.168.2.5:56715 -> 117.50.20.113:587
Source: global traffic	TCP traffic: 192.168.2.5:56717 -> 116.202.245.110:587
Source: global traffic	TCP traffic: 192.168.2.5:56721 -> 213.240.158.145:587
Source: global traffic	TCP traffic: 192.168.2.5:56722 -> 169.158.177.138:587
Source: global traffic	TCP traffic: 192.168.2.5:56730 -> 103.152.248.173:587
Source: global traffic	TCP traffic: 192.168.2.5:56732 -> 5.22.145.16:587
Source: global traffic	TCP traffic: 192.168.2.5:56733 -> 20.49.104.37:587
Source: global traffic	TCP traffic: 192.168.2.5:56745 -> 167.172.23.243:587
Source: global traffic	TCP traffic: 192.168.2.5:56748 -> 52.57.139.126:587
Source: global traffic	TCP traffic: 192.168.2.5:56753 -> 86.107.32.118:587
Source: global traffic	TCP traffic: 192.168.2.5:56756 -> 194.104.110.22:587
Source: global traffic	TCP traffic: 192.168.2.5:64526 -> 18.164.217.35:587
Source: global traffic	TCP traffic: 192.168.2.5:64531 -> 173.243.133.112:587
Source: global traffic	TCP traffic: 192.168.2.5:64535 -> 213.171.216.50:587
Source: global traffic	TCP traffic: 192.168.2.5:64547 -> 80.91.55.62:587
Source: global traffic	TCP traffic: 192.168.2.5:64555 -> 66.29.146.144:587
Source: global traffic	TCP traffic: 192.168.2.5:64562 -> 64.233.184.26:587
Source: global traffic	TCP traffic: 192.168.2.5:64576 -> 185.147.72.130:587
Source: global traffic	TCP traffic: 192.168.2.5:64577 -> 143.167.1.114:587
Source: global traffic	TCP traffic: 192.168.2.5:64585 -> 203.37.69.133:587
Source: global traffic	TCP traffic: 192.168.2.5:64610 -> 146.75.118.114:587
Source: global traffic	TCP traffic: 192.168.2.5:64618 -> 212.10.10.65:587
Source: global traffic	TCP traffic: 192.168.2.5:64619 -> 194.19.134.85:587
Source: global traffic	TCP traffic: 192.168.2.5:64621 -> 90.216.128.5:587
Source: global traffic	TCP traffic: 192.168.2.5:64640 -> 89.39.182.172:587
Source: global traffic	TCP traffic: 192.168.2.5:64642 -> 5.22.145.180:587
Source: global traffic	TCP traffic: 192.168.2.5:64644 -> 176.32.230.8:587
Source: global traffic	TCP traffic: 192.168.2.5:64654 -> 209.67.129.63:587
Source: global traffic	TCP traffic: 192.168.2.5:64675 -> 213.205.32.10:587
Source: global traffic	TCP traffic: 192.168.2.5:64679 -> 133.242.249.63:587
Source: global traffic	TCP traffic: 192.168.2.5:64681 -> 221.121.156.107:587
Source: global traffic	TCP traffic: 192.168.2.5:64688 -> 81.169.145.150:587
Source: global traffic	TCP traffic: 192.168.2.5:64691 -> 142.250.150.26:587
Source: global traffic	TCP traffic: 192.168.2.5:64693 -> 75.2.24.159:587
Source: global traffic	TCP traffic: 192.168.2.5:64708 -> 212.227.15.41:587

Source: global traffic

DNS traffic detected: number of DNS queries: 401

Source: Joe Sandbox View	IP Address: 77.78.119.119 77.78.119.119
Source: Joe Sandbox View	IP Address: 209.202.254.90 209.202.254.90

Source: global traffic	TCP traffic: 192.168.2.5:49681 -> 200.40.31.8:587
Source: global traffic	TCP traffic: 192.168.2.5:49683 -> 3.33.133.19:587
Source: global traffic	TCP traffic: 192.168.2.5:49684 -> 213.209.1.145:587
Source: global traffic	TCP traffic: 192.168.2.5:49685 -> 142.250.153.26:587
Source: global traffic	TCP traffic: 192.168.2.5:49688 -> 212.101.122.34:587
Source: global traffic	TCP traffic: 192.168.2.5:49689 -> 142.93.237.125:587
Source: global traffic	TCP traffic: 192.168.2.5:49690 -> 46.255.231.19:587
Source: global traffic	TCP traffic: 192.168.2.5:49691 -> 175.135.253.3:587
Source: global traffic	TCP traffic: 192.168.2.5:49692 -> 91.235.53.41:587
Source: global traffic	TCP traffic: 192.168.2.5:49694 -> 3.125.131.179:587
Source: global traffic	TCP traffic: 192.168.2.5:49695 -> 52.101.89.1:587
Source: global traffic	TCP traffic: 192.168.2.5:49696 -> 194.158.122.55:587
Source: global traffic	TCP traffic: 192.168.2.5:49697 -> 120.50.131.112:587
Source: global traffic	TCP traffic: 192.168.2.5:65454 -> 200.40.31.18:587
Source: global traffic	TCP traffic: 192.168.2.5:65455 -> 199.85.66.2:587
Source: global traffic	TCP traffic: 192.168.2.5:65464 -> 220.73.163.120:587
Source: global traffic	TCP traffic: 192.168.2.5:65466 -> 114.179.184.189:587
Source: global traffic	TCP traffic: 192.168.2.5:65473 -> 211.29.132.105:587
Source: global traffic	TCP traffic: 192.168.2.5:65474 -> 203.134.11.2:587
Source: global traffic	TCP traffic: 192.168.2.5:65478 -> 194.153.145.104:587
Source: global traffic	TCP traffic: 192.168.2.5:65482 -> 104.19.239.228:587
Source: global traffic	TCP traffic: 192.168.2.5:65487 -> 209.202.254.90:587
Source: global traffic	TCP traffic: 192.168.2.5:65489 -> 51.195.17.238:587
Source: global traffic	TCP traffic: 192.168.2.5:65490 -> 78.141.12.232:587
Source: global traffic	TCP traffic: 192.168.2.5:65501 -> 197.188.247.60:587
Source: global traffic	TCP traffic: 192.168.2.5:65502 -> 62.149.128.203:587
Source: global traffic	TCP traffic: 192.168.2.5:65507 -> 2.207.150.234:587
Source: global traffic	TCP traffic: 192.168.2.5:65508 -> 59.157.128.15:587
Source: global traffic	TCP traffic: 192.168.2.5:65509 -> 52.223.34.187:587
Source: global traffic	TCP traffic: 192.168.2.5:65513 -> 94.177.209.28:587
Source: global traffic	TCP traffic: 192.168.2.5:65514 -> 163.152.6.23:587
Source: global traffic	TCP traffic: 192.168.2.5:65516 -> 104.26.0.19:587
Source: global traffic	TCP traffic: 192.168.2.5:65521 -> 217.160.233.72:587
Source: global traffic	TCP traffic: 192.168.2.5:65524 -> 213.209.1.147:587
Source: global traffic	TCP traffic: 192.168.2.5:65531 -> 64.91.253.60:587
Source: global traffic	TCP traffic: 192.168.2.5:65532 -> 106.11.253.83:587
Source: global traffic	TCP traffic: 192.168.2.5:65533 -> 52.65.62.102:587
Source: global traffic	TCP traffic: 192.168.2.5:49159 -> 194.19.134.66:587
Source: global traffic	TCP traffic: 192.168.2.5:49161 -> 20.74.41.190:587
Source: global traffic	TCP traffic: 192.168.2.5:49163 -> 217.160.0.220:587
Source: global traffic	TCP traffic: 192.168.2.5:49165 -> 62.24.139.43:587
Source: global traffic	TCP traffic: 192.168.2.5:49173 -> 62.149.188.200:587
Source: global traffic	TCP traffic: 192.168.2.5:49174 -> 167.99.58.179:587
Source: global traffic	TCP traffic: 192.168.2.5:49175 -> 198.185.159.145:587
Source: global traffic	TCP traffic: 192.168.2.5:49180 -> 198.185.159.144:587
Source: global traffic	TCP traffic: 192.168.2.5:49185 -> 139.134.5.153:587
Source: global traffic	TCP traffic: 192.168.2.5:49187 -> 13.248.169.48:587
Source: global traffic	TCP traffic: 192.168.2.5:49191 -> 193.74.71.25:587
Source: global traffic	TCP traffic: 192.168.2.5:49193 -> 69.7.80.87:587
Source: global traffic	TCP traffic: 192.168.2.5:49195 -> 64.136.44.44:587
Source: global traffic	TCP traffic: 192.168.2.5:49199 -> 178.162.221.165:587
Source: global traffic	TCP traffic: 192.168.2.5:49208 -> 199.59.243.226:587
Source: global traffic	TCP traffic: 192.168.2.5:49209 -> 211.62.105.162:587
Source: global traffic	TCP traffic: 192.168.2.5:49210 -> 13.55.195.118:587
Source: global traffic	TCP traffic: 192.168.2.5:49211 -> 193.70.18.144:587
Source: global traffic	TCP traffic: 192.168.2.5:49212 -> 185.164.14.71:587
Source: global traffic	TCP traffic: 192.168.2.5:49213 -> 188.114.96.3:587
Source: global traffic	TCP traffic: 192.168.2.5:49216 -> 210.91.75.243:587
Source: global traffic	TCP traffic: 192.168.2.5:49221 -> 185.187.81.214:587
Source: global traffic	TCP traffic: 192.168.2.5:49238 -> 20.23.140.143:587
Source: global traffic	TCP traffic: 192.168.2.5:49240 -> 142.250.153.27:587
Source: global traffic	TCP traffic: 192.168.2.5:49243 -> 216.239.38.21:587
Source: global traffic	TCP traffic: 192.168.2.5:49252 -> 168.0.132.203:587
Source: global traffic	TCP traffic: 192.168.2.5:49260 -> 87.238.28.12:587
Source: global traffic	TCP traffic: 192.168.2.5:49264 -> 23.106.53.56:587
Source: global traffic	TCP traffic: 192.168.2.5:49275 -> 79.143.126.201:587
Source: global traffic	TCP traffic: 192.168.2.5:49277 -> 185.53.177.20:587
Source: global traffic	TCP traffic: 192.168.2.5:49283 -> 142.251.9.26:587
Source: global traffic	TCP traffic: 192.168.2.5:49284 -> 104.17.71.73:587
Source: global traffic	TCP traffic: 192.168.2.5:49286 -> 193.201.172.98:587
Source: global traffic	TCP traffic: 192.168.2.5:49298 -> 217.160.0.170:587
Source: global traffic	TCP traffic: 192.168.2.5:49305 -> 89.31.143.90:587
Source: global traffic	TCP traffic: 192.168.2.5:49308 -> 202.138.49.32:587
Source: global traffic	TCP traffic: 192.168.2.5:49315 -> 81.19.232.212:587
Source: global traffic	TCP traffic: 192.168.2.5:51675 -> 209.67.129.100:587
Source: global traffic	TCP traffic: 192.168.2.5:51685 -> 80.158.67.40:587
Source: global traffic	TCP traffic: 192.168.2.5:51686 -> 195.200.52.171:587
Source: global traffic	TCP traffic: 192.168.2.5:51692 -> 157.7.107.55:587
Source: global traffic	TCP traffic: 192.168.2.5:51698 -> 62.149.128.166:587
Source: global traffic	TCP traffic: 192.168.2.5:51699 -> 203.134.153.82:587
Source: global traffic	TCP traffic: 192.168.2.5:51702 -> 137.205.28.41:587
Source: global traffic	TCP traffic: 192.168.2.5:51704 -> 212.135.1.103:587
Source: global traffic	TCP traffic: 192.168.2.5:51706 -> 77.78.119.119:587
Source: global traffic	TCP traffic: 192.168.2.5:51712 -> 88.208.252.214:587
Source: global traffic	TCP traffic: 192.168.2.5:51717 -> 195.216.236.10:587
Source: global traffic	TCP traffic: 192.168.2.5:59100 -> 34.249.227.146:587
Source: global traffic	TCP traffic: 192.168.2.5:59102 -> 130.211.160.56:587
Source: global traffic	TCP traffic: 192.168.2.5:59106 -> 45.60.76.192:587
Source: global traffic	TCP traffic: 192.168.2.5:59111 -> 41.193.157.227:587
Source: global traffic	TCP traffic: 192.168.2.5:59129 -> 193.81.82.81:587
Source: global traffic	TCP traffic: 192.168.2.5:59131 -> 203.134.11.8:587
Source: global traffic	TCP traffic: 192.168.2.5:59133 -> 65.20.63.172:587
Source: global traffic	TCP traffic: 192.168.2.5:59146 -> 170.10.128.141:587
Source: global traffic	TCP traffic: 192.168.2.5:59149 -> 45.55.129.29:587
Source: global traffic	TCP traffic: 192.168.2.5:59156 -> 18.66.112.102:587
Source: global traffic	TCP traffic: 192.168.2.5:59173 -> 217.72.192.67:587
Source: global traffic	TCP traffic: 192.168.2.5:59190 -> 27.101.217.76:587
Source: global traffic	TCP traffic: 192.168.2.5:59199 -> 64.136.52.50:587
Source: global traffic	TCP traffic: 192.168.2.5:59204 -> 185.138.42.135:587
Source: global traffic	TCP traffic: 192.168.2.5:59205 -> 200.234.204.130:587
Source: global traffic	TCP traffic: 192.168.2.5:59208 -> 66.70.176.178:587
Source: global traffic	TCP traffic: 192.168.2.5:59235 -> 194.26.53.15:587
Source: global traffic	TCP traffic: 192.168.2.5:59236 -> 83.166.143.44:587
Source: global traffic	TCP traffic: 192.168.2.5:59245 -> 62.149.128.202:587
Source: global traffic	TCP traffic: 192.168.2.5:59248 -> 86.107.36.46:587
Source: global traffic	TCP traffic: 192.168.2.5:59258 -> 59.157.135.3:587
Source: global traffic	TCP traffic: 192.168.2.5:59262 -> 52.101.73.22:587
Source: global traffic	TCP traffic: 192.168.2.5:59288 -> 84.2.43.67:587
Source: global traffic	TCP traffic: 192.168.2.5:59294 -> 5.144.164.174:587
Source: global traffic	TCP traffic: 192.168.2.5:59296 -> 104.22.65.144:587
Source: global traffic	TCP traffic: 192.168.2.5:59297 -> 77.75.78.173:587
Source: global traffic	TCP traffic: 192.168.2.5:59299 -> 54.194.4.151:587
Source: global traffic	TCP traffic: 192.168.2.5:56703 -> 103.20.200.121:587
Source: global traffic	TCP traffic: 192.168.2.5:56710 -> 137.226.78.60:587
Source: global traffic	TCP traffic: 192.168.2.5:56715 -> 117.50.20.113:587
Source: global traffic	TCP traffic: 192.168.2.5:56717 -> 116.202.245.110:587
Source: global traffic	TCP traffic: 192.168.2.5:56721 -> 213.240.158.145:587
Source: global traffic	TCP traffic: 192.168.2.5:56722 -> 169.158.177.138:587
Source: global traffic	TCP traffic: 192.168.2.5:56730 -> 103.152.248.173:587
Source: global traffic	TCP traffic: 192.168.2.5:56732 -> 5.22.145.16:587
Source: global traffic	TCP traffic: 192.168.2.5:56733 -> 20.49.104.37:587
Source: global traffic	TCP traffic: 192.168.2.5:56745 -> 167.172.23.243:587
Source: global traffic	TCP traffic: 192.168.2.5:56748 -> 52.57.139.126:587
Source: global traffic	TCP traffic: 192.168.2.5:56753 -> 86.107.32.118:587
Source: global traffic	TCP traffic: 192.168.2.5:56756 -> 194.104.110.22:587
Source: global traffic	TCP traffic: 192.168.2.5:64526 -> 18.164.217.35:587
Source: global traffic	TCP traffic: 192.168.2.5:64531 -> 173.243.133.112:587
Source: global traffic	TCP traffic: 192.168.2.5:64535 -> 213.171.216.50:587
Source: global traffic	TCP traffic: 192.168.2.5:64547 -> 80.91.55.62:587
Source: global traffic	TCP traffic: 192.168.2.5:64555 -> 66.29.146.144:587
Source: global traffic	TCP traffic: 192.168.2.5:64562 -> 64.233.184.26:587
Source: global traffic	TCP traffic: 192.168.2.5:64576 -> 185.147.72.130:587
Source: global traffic	TCP traffic: 192.168.2.5:64577 -> 143.167.1.114:587
Source: global traffic	TCP traffic: 192.168.2.5:64585 -> 203.37.69.133:587
Source: global traffic	TCP traffic: 192.168.2.5:64610 -> 146.75.118.114:587
Source: global traffic	TCP traffic: 192.168.2.5:64618 -> 212.10.10.65:587
Source: global traffic	TCP traffic: 192.168.2.5:64619 -> 194.19.134.85:587
Source: global traffic	TCP traffic: 192.168.2.5:64621 -> 90.216.128.5:587
Source: global traffic	TCP traffic: 192.168.2.5:64640 -> 89.39.182.172:587
Source: global traffic	TCP traffic: 192.168.2.5:64642 -> 5.22.145.180:587
Source: global traffic	TCP traffic: 192.168.2.5:64644 -> 176.32.230.8:587
Source: global traffic	TCP traffic: 192.168.2.5:64654 -> 209.67.129.63:587
Source: global traffic	TCP traffic: 192.168.2.5:64675 -> 213.205.32.10:587
Source: global traffic	TCP traffic: 192.168.2.5:64679 -> 133.242.249.63:587
Source: global traffic	TCP traffic: 192.168.2.5:64681 -> 221.121.156.107:587
Source: global traffic	TCP traffic: 192.168.2.5:64688 -> 81.169.145.150:587
Source: global traffic	TCP traffic: 192.168.2.5:64691 -> 142.250.150.26:587
Source: global traffic	TCP traffic: 192.168.2.5:64693 -> 75.2.24.159:587
Source: global traffic	TCP traffic: 192.168.2.5:64708 -> 212.227.15.41:587

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: claywyaeropumps.com
Source: global traffic	DNS traffic detected: DNS query: mail.bitrot.co.uk
Source: global traffic	DNS traffic detected: DNS query: vera.com.uy
Source: global traffic	DNS traffic detected: DNS query: secure.gcfe.co.uk
Source: global traffic	DNS traffic detected: DNS query: securesmtp.hovepark.org.uk
Source: global traffic	DNS traffic detected: DNS query: r7.com
Source: global traffic	DNS traffic detected: DNS query: smtp.virgilio.it
Source: global traffic	DNS traffic detected: DNS query: mail.hct.zaq.ne.jp
Source: global traffic	DNS traffic detected: DNS query: mediagraphics.com.au
Source: global traffic	DNS traffic detected: DNS query: aspmx2.googlemail.com
Source: global traffic	DNS traffic detected: DNS query: vision.net.au
Source: global traffic	DNS traffic detected: DNS query: smtp.bindifencing.com.au
Source: global traffic	DNS traffic detected: DNS query: securesmtp.post.sk
Source: global traffic	DNS traffic detected: DNS query: mail.ivisby.se
Source: global traffic	DNS traffic detected: DNS query: mynet.com
Source: global traffic	DNS traffic detected: DNS query: mx.generic-isp.com
Source: global traffic	DNS traffic detected: DNS query: secure.visto.de
Source: global traffic	DNS traffic detected: DNS query: hcmp.co.kr
Source: global traffic	DNS traffic detected: DNS query: edcoms-co-uk.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: smtp.centrum.sk
Source: global traffic	DNS traffic detected: DNS query: nate.com
Source: global traffic	DNS traffic detected: DNS query: smtp.azet.sk
Source: global traffic	DNS traffic detected: DNS query: smtp.bbox.fr
Source: global traffic	DNS traffic detected: DNS query: mail.dk
Source: global traffic	DNS traffic detected: DNS query: out.metallbau-neubacher.at
Source: global traffic	DNS traffic detected: DNS query: adinet.com.uy
Source: global traffic	DNS traffic detected: DNS query: sympatico.ca
Source: global traffic	DNS traffic detected: DNS query: aspmx.l.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.goo.ne.jp
Source: global traffic	DNS traffic detected: DNS query: spool.mail.gandi.net
Source: global traffic	DNS traffic detected: DNS query: softbank.ne.jp
Source: global traffic	DNS traffic detected: DNS query: optusnet.com.au
Source: global traffic	DNS traffic detected: DNS query: brtph8a0.bnr.ca
Source: global traffic	DNS traffic detected: DNS query: w.cn
Source: global traffic	DNS traffic detected: DNS query: uk.mx2.mx25.net
Source: global traffic	DNS traffic detected: DNS query: abv.bg
Source: global traffic	DNS traffic detected: DNS query: secure.saegewerk-willeke.de
Source: global traffic	DNS traffic detected: DNS query: noos.fr
Source: global traffic	DNS traffic detected: DNS query: earthlink.net
Source: global traffic	DNS traffic detected: DNS query: aspmx3.googlemail.com
Source: global traffic	DNS traffic detected: DNS query: lycos.co.kr
Source: global traffic	DNS traffic detected: DNS query: excite.it
Source: global traffic	DNS traffic detected: DNS query: mail.dtponline.co.uk
Source: global traffic	DNS traffic detected: DNS query: securesmtp.surveymarketing.co.uk
Source: global traffic	DNS traffic detected: DNS query: alt3.aspmx.l.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.fairson.net.au
Source: global traffic	DNS traffic detected: DNS query: smtp.alpec.co.kr
Source: global traffic	DNS traffic detected: DNS query: smtp.iway.na
Source: global traffic	DNS traffic detected: DNS query: secure.savine.co.uk
Source: global traffic	DNS traffic detected: DNS query: securesmtp.oneplusone-group.jp
Source: global traffic	DNS traffic detected: DNS query: smtp.mckservice.it
Source: global traffic	DNS traffic detected: DNS query: smtp.dream.jp
Source: global traffic	DNS traffic detected: DNS query: secure.grassit.com.au
Source: global traffic	DNS traffic detected: DNS query: docomo.ne.jp
Source: global traffic	DNS traffic detected: DNS query: out.upsolutionpos.com
Source: global traffic	DNS traffic detected: DNS query: jvpc.be
Source: global traffic	DNS traffic detected: DNS query: smtp.vodafone.de
Source: global traffic	DNS traffic detected: DNS query: mail.email.pl
Source: global traffic	DNS traffic detected: DNS query: mail.hunterlegacy.com.au
Source: global traffic	DNS traffic detected: DNS query: smtp.korea.ac.kr
Source: global traffic	DNS traffic detected: DNS query: secure.heidenreich1.de
Source: global traffic	DNS traffic detected: DNS query: mail.aruba.it
Source: global traffic	DNS traffic detected: DNS query: mail.viahospital.com.tr
Source: global traffic	DNS traffic detected: DNS query: kawsaypacha.com
Source: global traffic	DNS traffic detected: DNS query: education.nsw.gov.au
Source: global traffic	DNS traffic detected: DNS query: ofir.dk
Source: global traffic	DNS traffic detected: DNS query: secure.bankofscotlandint.com
Source: global traffic	DNS traffic detected: DNS query: gaia.eonet.ne.jp
Source: global traffic	DNS traffic detected: DNS query: out.giftit.co.il
Source: global traffic	DNS traffic detected: DNS query: out.laste.ml
Source: global traffic	DNS traffic detected: DNS query: out.web.jp
Source: global traffic	DNS traffic detected: DNS query: wemo-barbing.de
Source: global traffic	DNS traffic detected: DNS query: dabrapids.com
Source: global traffic	DNS traffic detected: DNS query: smtp.geeko.be
Source: global traffic	DNS traffic detected: DNS query: secure.krea-druck.de
Source: global traffic	DNS traffic detected: DNS query: out.co.uk
Source: global traffic	DNS traffic detected: DNS query: smtp.inwind.it
Source: global traffic	DNS traffic detected: DNS query: secure.siii.au
Source: global traffic	DNS traffic detected: DNS query: chu-brest.fr
Source: global traffic	DNS traffic detected: DNS query: aliyun.com
Source: global traffic	DNS traffic detected: DNS query: securesmtp.lycos.it
Source: global traffic	DNS traffic detected: DNS query: swipnet.se
Source: global traffic	DNS traffic detected: DNS query: securesmtp.tre-engine.it
Source: global traffic	DNS traffic detected: DNS query: tinyworld.co.uk
Source: global traffic	DNS traffic detected: DNS query: smtp.cambridgecentrehonda.com
Source: global traffic	DNS traffic detected: DNS query: smtp.email.it
Source: global traffic	DNS traffic detected: DNS query: out.the-black-army.de
Source: global traffic	DNS traffic detected: DNS query: out.gut-gruppe.de
Source: global traffic	DNS traffic detected: DNS query: pep4teens.de
Source: global traffic	DNS traffic detected: DNS query: out.data61.csiro.au
Source: global traffic	DNS traffic detected: DNS query: smtp.lineone.net
Source: global traffic	DNS traffic detected: DNS query: out.peakinvest.com.au
Source: global traffic	DNS traffic detected: DNS query: securesmtp.skolaharmonia.sk
Source: global traffic	DNS traffic detected: DNS query: mail.comipems.org.mx
Source: global traffic	DNS traffic detected: DNS query: pec.it
Source: global traffic	DNS traffic detected: DNS query: securesmtp.confesercenti-al.it
Source: global traffic	DNS traffic detected: DNS query: smtp.architekt-lueke.de
Source: global traffic	DNS traffic detected: DNS query: mail.rocha.lel.br
Source: global traffic	DNS traffic detected: DNS query: myspace.com.au

Source: TL6bE5Uq4y.exe, 00000000.00000002.2353742946.0000000002CD5000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 00000004.00000002.2673193611.0000000002BED000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2791880326.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000008.00000002.2872171051.00000000035E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005CCC000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2385412046.0000000006A10000.00000004.08000000.00040000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2353742946.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005D98000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 00000004.00000002.2673193611.0000000002D75000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003D64000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2791880326.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000008.00000002.2872171051.0000000003783000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 0000000C.00000002.3302858252.000000000338A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005CCC000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2385412046.0000000006A10000.00000004.08000000.00040000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2353742946.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005D98000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 00000004.00000002.2681266896.0000000005BAE000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 00000004.00000002.2673193611.0000000002D75000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003D64000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2791880326.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000008.00000002.2872171051.0000000003783000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000008.00000002.2888369063.00000000064AE000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 0000000C.00000002.3302858252.000000000338A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005CCC000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2385412046.0000000006A10000.00000004.08000000.00040000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2353742946.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005D98000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 00000004.00000002.2673193611.0000000002D75000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003D64000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2791880326.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000008.00000002.2872171051.0000000003783000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 0000000C.00000002.3302858252.000000000338A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005CCC000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2385412046.0000000006A10000.00000004.08000000.00040000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2353742946.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005D98000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 00000004.00000002.2673193611.0000000002D75000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003D64000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2791880326.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000008.00000002.2872171051.0000000003783000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 0000000C.00000002.3302858252.000000000338A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005CCC000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2385412046.0000000006A10000.00000004.08000000.00040000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2353742946.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005D98000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2353742946.0000000002CD5000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 00000004.00000002.2673193611.0000000002B65000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 00000004.00000002.2673193611.0000000002D75000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003D64000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2791880326.0000000002949000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2791880326.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000008.00000002.2872171051.0000000003783000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000008.00000002.2872171051.000000000355A000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 0000000C.00000002.3302858252.000000000338A000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 0000000C.00000002.3302858252.0000000003149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005CCC000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2385412046.0000000006A10000.00000004.08000000.00040000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005D98000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003D64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Spam, unwanted Advertisements and Ransom Demands

Send many emails (e-Mail Spam)

Source: SMTP

Network traffic detected: Mail traffic on many different IPs 57

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe

File created: C:\Windows\Tasks\Test Task17.job

Jump to behavior

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Code function: 0_2_01100A58	0_2_01100A58
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Code function: 0_2_01100D38	0_2_01100D38
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Code function: 0_2_011016B2	0_2_011016B2
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Code function: 0_2_011020A1	0_2_011020A1
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Code function: 0_2_01102328	0_2_01102328
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Code function: 0_2_01100D72	0_2_01100D72
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Code function: 0_2_01100DE9	0_2_01100DE9
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Code function: 0_2_011017B5	0_2_011017B5
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Code function: 0_2_01101FF2	0_2_01101FF2
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Code function: 0_2_072ED4E8	0_2_072ED4E8
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Code function: 0_2_072D0006	0_2_072D0006
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Code function: 0_2_072D0040	0_2_072D0040
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Code function: 0_2_072EC9D8	0_2_072EC9D8
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 4_2_00EC0A58	4_2_00EC0A58
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 4_2_00EC0D38	4_2_00EC0D38
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 4_2_00EC16B2	4_2_00EC16B2
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 4_2_00EC20A1	4_2_00EC20A1
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 4_2_00EC2328	4_2_00EC2328
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 4_2_00EC0DE9	4_2_00EC0DE9
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 4_2_00EC0D72	4_2_00EC0D72
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 4_2_00EC0D28	4_2_00EC0D28
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 4_2_00EC17B5	4_2_00EC17B5
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 4_2_00EC1FF1	4_2_00EC1FF1
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 4_2_0711D4E8	4_2_0711D4E8
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 4_2_07100007	4_2_07100007
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 4_2_07100040	4_2_07100040
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 4_2_0711C9D8	4_2_0711C9D8
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 5_2_024E0A58	5_2_024E0A58
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 5_2_024E0D38	5_2_024E0D38
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 5_2_024E16B2	5_2_024E16B2
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 5_2_024E1FF1	5_2_024E1FF1
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 5_2_024E2328	5_2_024E2328
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 5_2_024E20A1	5_2_024E20A1
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 5_2_024E0D72	5_2_024E0D72
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 5_2_024E0D28	5_2_024E0D28
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 5_2_024E0DE9	5_2_024E0DE9
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 5_2_024E17B5	5_2_024E17B5
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 5_2_06FBD4E8	5_2_06FBD4E8
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 5_2_06FA0040	5_2_06FA0040
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 5_2_06FA0016	5_2_06FA0016
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 5_2_06FBC9D8	5_2_06FBC9D8
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_016A0A58	8_2_016A0A58
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_016A0D38	8_2_016A0D38
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_016A16B2	8_2_016A16B2
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_016A20A1	8_2_016A20A1
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_016A2328	8_2_016A2328
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_016A0D72	8_2_016A0D72
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_016A0D28	8_2_016A0D28
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_016A0DE9	8_2_016A0DE9
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_016A17B5	8_2_016A17B5
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_016A1FF2	8_2_016A1FF2
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B73570	8_2_06B73570
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B73561	8_2_06B73561
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B73828	8_2_06B73828
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B73817	8_2_06B73817
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B9DFB3	8_2_06B9DFB3
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B937DA	8_2_06B937DA
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B9EC80	8_2_06B9EC80
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B92508	8_2_06B92508
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B94BD4	8_2_06B94BD4
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B966B8	8_2_06B966B8
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B966C8	8_2_06B966C8
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B924F8	8_2_06B924F8
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B9EC70	8_2_06B9EC70
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B98DE8	8_2_06B98DE8
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B98DD8	8_2_06B98DD8
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B97BB0	8_2_06B97BB0
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B97BA2	8_2_06B97BA2
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B9D810	8_2_06B9D810
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B9D800	8_2_06B9D800
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_0746D4E8	8_2_0746D4E8
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_0746C9D8	8_2_0746C9D8
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_07450040	8_2_07450040
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_07450006	8_2_07450006
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 12_2_02E20A58	12_2_02E20A58
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 12_2_02E20D38	12_2_02E20D38
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 12_2_02E216B2	12_2_02E216B2
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 12_2_02E22328	12_2_02E22328
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 12_2_02E220A1	12_2_02E220A1
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 12_2_02E20DE9	12_2_02E20DE9
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 12_2_02E20D72	12_2_02E20D72
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 12_2_02E20D28	12_2_02E20D28
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 12_2_02E217B5	12_2_02E217B5
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 12_2_02E21FF1	12_2_02E21FF1
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 12_2_0774D4E8	12_2_0774D4E8
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 12_2_07730040	12_2_07730040
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 12_2_07730007	12_2_07730007
Source: C:\ProgramData\lcsxp\atebcv.exe	Code function: 12_2_0774C9D8	12_2_0774C9D8

Source: TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005CCC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs TL6bE5Uq4y.exe
Source: TL6bE5Uq4y.exe, 00000000.00000002.2369432268.00000000058A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameJvspv.dll" vs TL6bE5Uq4y.exe
Source: TL6bE5Uq4y.exe, 00000000.00000002.2385412046.0000000006A10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs TL6bE5Uq4y.exe
Source: TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs TL6bE5Uq4y.exe
Source: TL6bE5Uq4y.exe, 00000000.00000002.2352581900.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs TL6bE5Uq4y.exe
Source: TL6bE5Uq4y.exe, 00000000.00000002.2353742946.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs TL6bE5Uq4y.exe
Source: TL6bE5Uq4y.exe, 00000000.00000002.2386794533.0000000006C20000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs TL6bE5Uq4y.exe
Source: TL6bE5Uq4y.exe, 00000000.00000002.2379847646.00000000064D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameJvspv.dll" vs TL6bE5Uq4y.exe
Source: TL6bE5Uq4y.exe, 00000000.00000002.2353742946.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs TL6bE5Uq4y.exe
Source: TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005D98000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs TL6bE5Uq4y.exe
Source: TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005D98000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs TL6bE5Uq4y.exe
Source: TL6bE5Uq4y.exe, 00000000.00000002.2353742946.0000000002CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs TL6bE5Uq4y.exe
Source: TL6bE5Uq4y.exe, 00000000.00000000.2036702736.000000000075C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamerealtekaft.exe6 vs TL6bE5Uq4y.exe
Source: TL6bE5Uq4y.exe, 00000000.00000002.2387602342.0000000007321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamerealtekaft.exe6 vs TL6bE5Uq4y.exe
Source: TL6bE5Uq4y.exe, 00000000.00000002.2369432268.00000000052A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameJvspv.dll" vs TL6bE5Uq4y.exe
Source: TL6bE5Uq4y.exe	Binary or memory string: OriginalFilenamerealtekaft.exe6 vs TL6bE5Uq4y.exe

Source: TL6bE5Uq4y.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 0.2.TL6bE5Uq4y.exe.5e069f8.13.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.TL6bE5Uq4y.exe.5e069f8.13.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.TL6bE5Uq4y.exe.5e069f8.13.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.TL6bE5Uq4y.exe.5e069f8.13.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'

Source: 0.2.TL6bE5Uq4y.exe.5e069f8.13.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.TL6bE5Uq4y.exe.5e069f8.13.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.TL6bE5Uq4y.exe.5e069f8.13.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.TL6bE5Uq4y.exe.5e069f8.13.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.TL6bE5Uq4y.exe.5e069f8.13.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.TL6bE5Uq4y.exe.5e069f8.13.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)

Source: classification engine

Classification label: mal100.spre.troj.evad.winEXE@13/10@471/100

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe

Code function: 3_2_0040166B CreateToolhelp32Snapshot,

3_2_0040166B

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe

File created: C:\Users\user\AppData\Roaming\Erddbfj.exe

Jump to behavior

Source: C:\ProgramData\lcsxp\atebcv.exe	Mutant created: NULL
Source: C:\ProgramData\lcsxp\atebcv.exe	Mutant created: \Sessions\1\BaseNamedObjects\Test Task17

Source: TL6bE5Uq4y.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: TL6bE5Uq4y.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: TL6bE5Uq4y.exe	ReversingLabs: Detection: 71%
Source: TL6bE5Uq4y.exe	Virustotal: Detection: 67%

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe

File read: C:\Users\user\Desktop\TL6bE5Uq4y.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\TL6bE5Uq4y.exe "C:\Users\user\Desktop\TL6bE5Uq4y.exe"
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process created: C:\Users\user\Desktop\TL6bE5Uq4y.exe "C:\Users\user\Desktop\TL6bE5Uq4y.exe"
Source: unknown	Process created: C:\ProgramData\lcsxp\atebcv.exe C:\ProgramData\lcsxp\atebcv.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Erddbfj.exe "C:\Users\user\AppData\Roaming\Erddbfj.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Erddbfj.exe "C:\Users\user\AppData\Roaming\Erddbfj.exe"
Source: C:\ProgramData\lcsxp\atebcv.exe	Process created: C:\ProgramData\lcsxp\atebcv.exe "C:\ProgramData\lcsxp\atebcv.exe"
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process created: C:\Users\user\AppData\Roaming\Erddbfj.exe "C:\Users\user\AppData\Roaming\Erddbfj.exe"
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process created: C:\Users\user\AppData\Roaming\Erddbfj.exe "C:\Users\user\AppData\Roaming\Erddbfj.exe"
Source: unknown	Process created: C:\ProgramData\lcsxp\atebcv.exe C:\ProgramData\lcsxp\atebcv.exe
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process created: C:\Users\user\Desktop\TL6bE5Uq4y.exe "C:\Users\user\Desktop\TL6bE5Uq4y.exe"	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process created: C:\ProgramData\lcsxp\atebcv.exe "C:\ProgramData\lcsxp\atebcv.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process created: C:\Users\user\AppData\Roaming\Erddbfj.exe "C:\Users\user\AppData\Roaming\Erddbfj.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process created: C:\Users\user\AppData\Roaming\Erddbfj.exe "C:\Users\user\AppData\Roaming\Erddbfj.exe"	Jump to behavior

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Section loaded: mstask.dll
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: version.dll
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: wldp.dll
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: amsi.dll
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: userenv.dll
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: profapi.dll
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: gpapi.dll
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\lcsxp\atebcv.exe	Section loaded: windows.storage.dll

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: TL6bE5Uq4y.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: TL6bE5Uq4y.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: TL6bE5Uq4y.exe

Static file information: File size 4427776 > 1048576

Source: TL6bE5Uq4y.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x438600

Source: TL6bE5Uq4y.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005E56000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2386794533.0000000006C20000.00000004.08000000.00040000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005D98000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2353742946.0000000002CD5000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 00000004.00000002.2673193611.0000000002BED000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003EEF000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2791880326.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000008.00000002.2872171051.00000000035E2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005E56000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2386794533.0000000006C20000.00000004.08000000.00040000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005D98000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2353742946.0000000002CD5000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 00000004.00000002.2673193611.0000000002BED000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003EEF000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2791880326.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000008.00000002.2872171051.00000000035E2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005CCC000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2385412046.0000000006A10000.00000004.08000000.00040000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2353742946.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005D98000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 00000004.00000002.2673193611.0000000002D75000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003D64000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2791880326.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000008.00000002.2872171051.0000000003783000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 0000000C.00000002.3302858252.000000000338A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005CCC000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2385412046.0000000006A10000.00000004.08000000.00040000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2353742946.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2369432268.0000000005D98000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 00000004.00000002.2673193611.0000000002D75000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2801205253.0000000003D64000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2791880326.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000008.00000002.2872171051.0000000003783000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 0000000C.00000002.3302858252.000000000338A000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.TL6bE5Uq4y.exe.5e069f8.13.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.TL6bE5Uq4y.exe.5e069f8.13.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.TL6bE5Uq4y.exe.5e069f8.13.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties

Yara detected Costura Assembly Loader

Source: Yara match	File source: 4.2.atebcv.exe.59fc538.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.4ac6710.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.atebcv.exe.4474ba0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.atebcv.exe.5a9c558.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Erddbfj.exe.3c74ba0.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.atebcv.exe.59ac518.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.69b0000.20.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.5bdc518.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.atebcv.exe.341c4f0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Erddbfj.exe.508cd88.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Erddbfj.exe.62ac518.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.2f9dd28.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.atebcv.exe.2e2dc24.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Erddbfj.exe.62ac518.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.atebcv.exe.4956710.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.2f9dd28.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Erddbfj.exe.3d64be0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.5c2c538.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Erddbfj.exe.2c208f0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Erddbfj.exe.3839b08.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.atebcv.exe.341c4f0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Erddbfj.exe.639c558.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Erddbfj.exe.3cc4bc0.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Erddbfj.exe.62fc538.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.atebcv.exe.59ac518.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Erddbfj.exe.5366710.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Erddbfj.exe.3c74ba0.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.5bdc518.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.atebcv.exe.2e2dc24.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Erddbfj.exe.3839b08.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Erddbfj.exe.2c208f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.5ccc558.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2888369063.000000000639C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2888369063.00000000062AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2681266896.00000000059FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2681266896.00000000059AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3321385498.0000000004474000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2369432268.0000000005CCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2791880326.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2885936304.0000000005366000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2801205253.0000000003BD2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2801205253.0000000003D64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2681266896.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2385035151.00000000069B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2888369063.00000000062FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2369432268.00000000058A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2808346384.0000000004ECC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2679390796.0000000004956000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2872171051.0000000003783000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3302858252.000000000338A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2355779082.0000000004989000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3302858252.00000000030CE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2353742946.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2673193611.0000000002D75000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2353742946.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2791880326.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2872171051.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2673193611.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TL6bE5Uq4y.exe PID: 2888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: atebcv.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Erddbfj.exe PID: 3948, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Erddbfj.exe PID: 4676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: atebcv.exe PID: 8920, type: MEMORYSTR

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Code function: 3_2_0040565F push FFFFFFFBh; ret	3_2_00405661
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B76A4B push ecx; iretd	8_2_06B76A51
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B9AE9B push es; retf	8_2_06B9AEB4
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Code function: 8_2_06B9ACFA push es; iretd	8_2_06B9AD38

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	File created: C:\ProgramData\lcsxp\atebcv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	File created: C:\Users\user\AppData\Roaming\Erddbfj.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	File created: C:\ProgramData\vjejxvf\ohjwtp.exe	Jump to dropped file

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	File created: C:\ProgramData\lcsxp\atebcv.exe			Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	File created: C:\ProgramData\vjejxvf\ohjwtp.exe			Jump to dropped file

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe

File created: C:\Windows\Tasks\Test Task17.job

Jump to behavior

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Erddbfj			Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Erddbfj			Jump to behavior

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lcsxp\atebcv.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: TL6bE5Uq4y.exe PID: 2888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: atebcv.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Erddbfj.exe PID: 3948, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Erddbfj.exe PID: 4676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: atebcv.exe PID: 8920, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: TL6bE5Uq4y.exe, 00000000.00000002.2353742946.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, TL6bE5Uq4y.exe, 00000000.00000002.2353742946.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 00000004.00000002.2673193611.0000000002D75000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 00000004.00000002.2673193611.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2791880326.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000005.00000002.2791880326.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000008.00000002.2872171051.0000000003783000.00000004.00000800.00020000.00000000.sdmp, Erddbfj.exe, 00000008.00000002.2872171051.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 0000000C.00000002.3302858252.000000000338A000.00000004.00000800.00020000.00000000.sdmp, atebcv.exe, 0000000C.00000002.3302858252.00000000030CE000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL0SELECT * FROM WIN32_BIOS8UNEXPECTED WMI QUERY FAILURE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	RDTSC instruction interceptor: First address: 402E5A second address: 402E5A instructions: 0x00000000 rdtsc 0x00000002 push ebp 0x00000003 mov ebp, esp 0x00000005 push ebx 0x00000006 push ecx 0x00000007 push edx 0x00000008 push edi 0x00000009 push esi 0x0000000a imul eax, eax, 001E7319h 0x00000010 add eax, 3CFB5543h 0x00000015 rcr eax, 10h 0x00000018 add eax, esi 0x0000001a imul eax, edi 0x0000001d xor edx, edx 0x0000001f mul dword ptr [ebp+08h] 0x00000022 mov eax, edx 0x00000024 pop esi 0x00000025 pop edi 0x00000026 pop edx 0x00000027 pop ecx 0x00000028 pop ebx 0x00000029 leave 0x0000002a retn 0004h 0x0000002d lea eax, dword ptr [eax+00000300h] 0x00000033 push eax 0x00000034 push 00405C2Fh 0x00000039 call 00007F3E952CC9ACh 0x0000003e push ebp 0x0000003f mov ebp, esp 0x00000041 push ebx 0x00000042 push edi 0x00000043 push esi 0x00000044 mov edi, dword ptr [ebp+08h] 0x00000047 push 000000FFh 0x0000004c call 00007F3E952CB169h 0x00000051 rdtsc
Source: C:\ProgramData\lcsxp\atebcv.exe	RDTSC instruction interceptor: First address: 402E5A second address: 402E5A instructions: 0x00000000 rdtsc 0x00000002 push ebp 0x00000003 mov ebp, esp 0x00000005 push ebx 0x00000006 push ecx 0x00000007 push edx 0x00000008 push edi 0x00000009 push esi 0x0000000a imul eax, eax, 001E7319h 0x00000010 add eax, 3CFB5543h 0x00000015 rcr eax, 10h 0x00000018 add eax, esi 0x0000001a imul eax, edi 0x0000001d xor edx, edx 0x0000001f mul dword ptr [ebp+08h] 0x00000022 mov eax, edx 0x00000024 pop esi 0x00000025 pop edi 0x00000026 pop edx 0x00000027 pop ecx 0x00000028 pop ebx 0x00000029 leave 0x0000002a retn 0004h 0x0000002d lea eax, dword ptr [eax+00000300h] 0x00000033 push eax 0x00000034 push 00405C2Fh 0x00000039 call 00007F3E94855C9Ch 0x0000003e push ebp 0x0000003f mov ebp, esp 0x00000041 push ebx 0x00000042 push edi 0x00000043 push esi 0x00000044 mov edi, dword ptr [ebp+08h] 0x00000047 push 000000FFh 0x0000004c call 00007F3E94854459h 0x00000051 rdtsc
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	RDTSC instruction interceptor: First address: 402E5A second address: 402E5A instructions: 0x00000000 rdtsc 0x00000002 push ebp 0x00000003 mov ebp, esp 0x00000005 push ebx 0x00000006 push ecx 0x00000007 push edx 0x00000008 push edi 0x00000009 push esi 0x0000000a imul eax, eax, 001E7319h 0x00000010 add eax, 3CFB5543h 0x00000015 rcr eax, 10h 0x00000018 add eax, esi 0x0000001a imul eax, edi 0x0000001d xor edx, edx 0x0000001f mul dword ptr [ebp+08h] 0x00000022 mov eax, edx 0x00000024 pop esi 0x00000025 pop edi 0x00000026 pop edx 0x00000027 pop ecx 0x00000028 pop ebx 0x00000029 leave 0x0000002a retn 0004h 0x0000002d lea eax, dword ptr [eax+00000300h] 0x00000033 push eax 0x00000034 push 00405C2Fh 0x00000039 call 00007F3E952CC9ACh 0x0000003e push ebp 0x0000003f mov ebp, esp 0x00000041 push ebx 0x00000042 push edi 0x00000043 push esi 0x00000044 mov edi, dword ptr [ebp+08h] 0x00000047 push 000000FFh 0x0000004c call 00007F3E952CB169h 0x00000051 rdtsc

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Memory allocated: 10C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Memory allocated: 2B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Memory allocated: 28C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Memory allocated: 52A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Memory allocated: 62A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Memory allocated: 7320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Memory allocated: 8320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Memory allocated: EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Memory allocated: 29A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Memory allocated: 49A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Memory allocated: 5070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Memory allocated: 6070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Memory allocated: 7150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Memory allocated: 8150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Memory allocated: 24E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Memory allocated: 27A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Memory allocated: 47A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Memory allocated: 4EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Memory allocated: 5EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Memory allocated: 16A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Memory allocated: 33B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Memory allocated: 1900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Memory allocated: 5970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Memory allocated: 6970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Memory allocated: 1630000 memory reserve \| memory write watch
Source: C:\ProgramData\lcsxp\atebcv.exe	Memory allocated: 2FA0000 memory reserve \| memory write watch
Source: C:\ProgramData\lcsxp\atebcv.exe	Memory allocated: 4FA0000 memory reserve \| memory write watch
Source: C:\ProgramData\lcsxp\atebcv.exe	Memory allocated: 5660000 memory reserve \| memory write watch
Source: C:\ProgramData\lcsxp\atebcv.exe	Memory allocated: 6660000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe

Code function: 3_2_00402E5A rdtsc

3_2_00402E5A

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe TID: 7096	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe TID: 6184	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe TID: 5676	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe TID: 7056	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe TID: 6008	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe TID: 6632	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe TID: 5516	Thread sleep time: -60000s >= -30000s

Source: C:\ProgramData\lcsxp\atebcv.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Thread delayed: delay time: 60000

Source: atebcv.exe, 0000000C.00000002.3302858252.00000000030CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: atebcv.exe, 0000000C.00000002.3302858252.00000000030CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: atebcv.exe, 00000009.00000002.3297473729.0000000001948000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe

Code function: 3_2_00402E5A rdtsc

3_2_00402E5A

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe

Code function: 3_2_00402E87 LdrLoadDll,

3_2_00402E87

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe

Code function: 3_2_00402E87 mov eax, dword ptr fs:[00000030h]

3_2_00402E87

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe

Code function: 3_2_00401000 EntryPoint,CreateThread,SetUnhandledExceptionFilter,GetModuleFileNameW,EnumWindows,GetEnvironmentVariableW,CreateDirectoryW,CopyFileW,CopyFileW,Sleep,CreateMutexW,ExitProcess,

3_2_00401000

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Process created: C:\Users\user\Desktop\TL6bE5Uq4y.exe "C:\Users\user\Desktop\TL6bE5Uq4y.exe"	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Process created: C:\ProgramData\lcsxp\atebcv.exe "C:\ProgramData\lcsxp\atebcv.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process created: C:\Users\user\AppData\Roaming\Erddbfj.exe "C:\Users\user\AppData\Roaming\Erddbfj.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Process created: C:\Users\user\AppData\Roaming\Erddbfj.exe "C:\Users\user\AppData\Roaming\Erddbfj.exe"	Jump to behavior

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Queries volume information: C:\Users\user\Desktop\TL6bE5Uq4y.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Queries volume information: C:\ProgramData\lcsxp\atebcv.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Queries volume information: C:\Users\user\AppData\Roaming\Erddbfj.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Queries volume information: C:\Users\user\AppData\Roaming\Erddbfj.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Erddbfj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\lcsxp\atebcv.exe	Queries volume information: C:\ProgramData\lcsxp\atebcv.exe VolumeInformation
Source: C:\ProgramData\lcsxp\atebcv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\ProgramData\lcsxp\atebcv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe

Code function: 3_2_00401806 CoInitialize,GetUserNameW,GetSystemTime,

3_2_00401806

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe

Code function: 3_2_00401806 CoInitialize,GetUserNameW,GetSystemTime,

3_2_00401806

Source: C:\Users\user\Desktop\TL6bE5Uq4y.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.47fd1f0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.47bd1d0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.479d1b0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.479d1b0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.54a1038.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.64d0000.19.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.47fd1f0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.54a1038.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.47bd1d0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.64d0000.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2369432268.00000000058A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2379847646.00000000064D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2369432268.00000000052A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2355779082.0000000004511000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected SystemBC

Source: Yara match	File source: 8.2.Erddbfj.exe.366124c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.2ded204.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.atebcv.exe.2c76f68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.atebcv.exe.2c6cd90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Erddbfj.exe.366b424.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Erddbfj.exe.2a508f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.2de302c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Erddbfj.exe.2a5aac8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2872171051.000000000365D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2791880326.0000000002A58000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2791880326.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2353742946.0000000002DDF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2673193611.0000000002C69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2872171051.0000000003669000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2673193611.0000000002C74000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2353742946.0000000002DEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3296396978.00000000005A5000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TL6bE5Uq4y.exe PID: 2888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: atebcv.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Erddbfj.exe PID: 3948, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Erddbfj.exe PID: 4676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Erddbfj.exe PID: 2696, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.47fd1f0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.47bd1d0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.479d1b0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.479d1b0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.54a1038.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.64d0000.19.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.47fd1f0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.54a1038.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.47bd1d0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.64d0000.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2369432268.00000000058A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2379847646.00000000064D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2369432268.00000000052A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2355779082.0000000004511000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected SystemBC

Source: Yara match	File source: 8.2.Erddbfj.exe.366124c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.2ded204.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.atebcv.exe.2c76f68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.atebcv.exe.2c6cd90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Erddbfj.exe.366b424.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Erddbfj.exe.2a508f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TL6bE5Uq4y.exe.2de302c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Erddbfj.exe.2a5aac8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2872171051.000000000365D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2791880326.0000000002A58000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2791880326.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2353742946.0000000002DDF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2673193611.0000000002C69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2872171051.0000000003669000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2673193611.0000000002C74000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2353742946.0000000002DEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3296396978.00000000005A5000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TL6bE5Uq4y.exe PID: 2888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: atebcv.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Erddbfj.exe PID: 3948, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Erddbfj.exe PID: 4676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Erddbfj.exe PID: 2696, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Scheduled Task/Job	11 Scheduled Task/Job	11 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	11 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	311 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	111 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	113 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report TL6bE5Uq4y.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SystemBC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
TL6bE5Uq4y.exe